pagesight 0.18.0 → 0.20.0

package/src/api/assessment.ts

@@ -0,0 +1,315 @@
+import { z } from "zod";
+import { capture, type Evidence } from "./evidence.js";
+import type { ImportedSnapshot } from "./evidence-schema.js";
+import { configSchema, gaRequestSchema, gscRequestSchema } from "./schema.js";
+import { snapshotOperations, observationName } from "./snapshot.js";
+import { canonical, normalizeReport, parseNumericValue } from "./report-table.js";
+import { normalizeGaProperty } from "../providers/ga.js";
+
+interface Finding {
+  code: string;
+  level: "attention" | "info" | "unknown";
+  message: string;
+  sources: string[];
+  nextCheck: string;
+}
+export interface AssessmentTable {
+  observation: string;
+  scope: "search-property" | "production" | "production-organic" | "all-hostnames";
+  dimensions: string[];
+  metrics: string[];
+  rows: Array<{ keys: string[]; values: Array<string | number> }>;
+  observedRows: number;
+  displayedRows: number;
+  complete: boolean;
+  limitations: string[];
+}
+
+function reportScope(provider: string, request: unknown) {
+  if (provider === "ga") {
+    const { offset: _offset, limit: _limit, returnPropertyQuota: _quota, ...scope } = gaRequestSchema.parse(request);
+    return scope;
+  }
+  const { startRow: _offset, rowLimit: _limit, ...scope } = gscRequestSchema.parse(request);
+  return scope;
+}
+
+export async function assessSnapshot(snapshot: ImportedSnapshot, maxRows: number): Promise<Evidence> {
+  const { context, observations } = snapshot.pages[0].response;
+  const config = configSchema.parse(context.config);
+  const { startDate, endDate } = context.requestedDates;
+  const hash = Bun.CryptoHasher.hash("sha256", canonical(snapshot), "hex");
+  const result = await capture("pagesight", "assess", snapshot.target, { snapshotSha256: hash, maxRows }, async () => {
+    const findings: Finding[] = [];
+    const tables: AssessmentTable[] = [];
+    let configuredKeyEvents: Array<{ eventName: string; countingMethod?: string }> = [];
+    const keyEventSource = observations.find((o) => o.name === "ga.key-events");
+    const add = (code: string, level: Finding["level"], message: string, sources: string[], nextCheck: string) =>
+      findings.push({ code, level, message, sources, nextCheck });
+    if (config.gaProperty) {
+      if (!config.context.successEvents.length)
+        add(
+          "no-success-events",
+          "attention",
+          "No success events are designated in the site configuration. Reported key events are not validated product outcomes.",
+          ["context.config.context.successEvents"],
+          "Define the useful visitor action, then verify its tracking before evaluating SEO outcomes.",
+        );
+      else
+        add(
+          "success-events-unverified",
+          "info",
+          `Site configuration designates ${config.context.successEvents.length} success event(s); showing ${Math.min(config.context.successEvents.length, maxRows)}: ${config.context.successEvents.slice(0, maxRows).join(", ")} as success events; Pagesight has not independently validated them.`,
+          ["context.config.context.successEvents"],
+          "Verify each event against a real user action and provider reports.",
+        );
+    }
+    if (config.gaProperty) {
+      if (!keyEventSource || keyEventSource.status === "error" || !keyEventSource.pages.length)
+        add(
+          "key-event-metadata-unavailable",
+          "unknown",
+          "Configured GA key-event metadata is unavailable.",
+          ["ga.key-events"],
+          "Read GA key-event metadata separately from observed event counts.",
+        );
+      else {
+        try {
+          if (
+            keyEventSource.provider !== "ga" ||
+            keyEventSource.operation !== "key-events" ||
+            keyEventSource.target !== normalizeGaProperty(config.gaProperty)
+          )
+            throw new Error();
+          const metadata = z.object({
+            keyEvents: z
+              .array(z.object({ eventName: z.string().min(1), countingMethod: z.string().optional() }))
+              .default([]),
+            nextPageToken: z.string().optional(),
+          });
+          const pages = keyEventSource.pages.map((p) => metadata.parse(p.response));
+          configuredKeyEvents = pages.flatMap((p) => p.keyEvents);
+          if (pages.some((p) => p.nextPageToken) || keyEventSource.status !== "ok" || keyEventSource.error)
+            add(
+              "key-event-metadata-partial",
+              "unknown",
+              "Only part of the configured key-event list is available.",
+              ["ga.key-events"],
+              "Retrieve the remaining metadata before claiming this is the complete configuration.",
+            );
+          add(
+            "configured-key-events",
+            "info",
+            `GA configuration contains ${configuredKeyEvents.length} observed key-event entries; showing ${Math.min(configuredKeyEvents.length, maxRows)}: ${
+              configuredKeyEvents
+                .slice(0, maxRows)
+                .map((e) => `${e.eventName}${e.countingMethod ? ` (${e.countingMethod})` : ""}`)
+                .join(", ") || "no observed key-event entries"
+            }. Configuration does not prove events occurred or outcomes are valid.`,
+            ["ga.key-events"],
+            "Compare configured events with observed report rows and separately validate their business meaning.",
+          );
+        } catch {
+          add(
+            "key-event-metadata-unusable",
+            "unknown",
+            "Key-event metadata does not match the configured property or supported shape.",
+            ["ga.key-events"],
+            "Recollect key-event metadata for the configured property.",
+          );
+        }
+      }
+    }
+    for (const operation of snapshotOperations(config, startDate, endDate, 1)) {
+      if (operation.operation !== "ga.report" && operation.operation !== "gsc.report") continue;
+      if (
+        operation.operation === "gsc.report" &&
+        operation.request.dimensions?.some((d) => ["date", "hour"].includes(d))
+      )
+        continue;
+      const name = observationName(operation);
+      const observation = observations.find((o) => o.name === name);
+      if (!observation || observation.status === "error" || !observation.pages.length) {
+        add(
+          "report-unavailable",
+          "unknown",
+          `${name}: no usable report is available.`,
+          [name],
+          "Collect or retry this report; absence is not zero activity.",
+        );
+        continue;
+      }
+      try {
+        const provider = operation.operation === "ga.report" ? "ga" : "gsc";
+        const target = operation.operation === "ga.report" ? normalizeGaProperty(operation.property) : operation.site;
+        if (observation.provider !== provider || observation.operation !== "report" || observation.target !== target)
+          throw new Error("Provider or property does not match the site configuration.");
+        for (const page of observation.pages)
+          if (canonical(reportScope(provider, page.request)) !== canonical(reportScope(provider, operation.request)))
+            throw new Error("Report filters, dates or dimensions do not match the configured snapshot report.");
+        const normalized = normalizeReport(observation, context);
+        if (
+          provider === "gsc" &&
+          normalized.dimensions.length === 0 &&
+          observation.pages.some(
+            (p) => (p.response as { responseAggregationType?: string }).responseAggregationType !== "byProperty",
+          )
+        )
+          throw new Error("GSC property totals require byProperty response aggregation.");
+        const allRows = [...normalized.rows.values()];
+        const limitations = [...new Set([...observation.warnings, ...normalized.warnings])];
+        const complete =
+          observation.status === "ok" && !observation.error && observation.pagination?.exhausted === true;
+        const sorted = [...allRows].sort((a, b) => {
+          const av = parseNumericValue(a.values[0]);
+          const bv = parseNumericValue(b.values[0]);
+          return (bv ?? -Infinity) - (av ?? -Infinity) || canonical(a.keys).localeCompare(canonical(b.keys));
+        });
+        const scope =
+          provider === "gsc"
+            ? "search-property"
+            : normalized.dimensions[0] === "hostName"
+              ? "all-hostnames"
+              : name.endsWith(".organic")
+                ? "production-organic"
+                : "production";
+        tables.push({
+          observation: name,
+          scope,
+          dimensions: normalized.dimensions,
+          metrics: normalized.metrics,
+          rows: sorted.slice(0, maxRows),
+          observedRows: allRows.length,
+          displayedRows: Math.min(allRows.length, maxRows),
+          complete,
+          limitations,
+        });
+        if (name === "ga.report.landingPagePlusQueryString+sessionSource+eventName.organic")
+          add(
+            "organic-landing-events",
+            "info",
+            "These event occurrences are associated with organic sessions' landing pages, not necessarily the pages where the events occurred. Counts are not unique sessions, conversion rates or validated outcomes.",
+            [name, "ga.report.landingPagePlusQueryString+sessionSource.organic"],
+            "Inspect relevant event names alongside landing-page traffic. Preserve raw query strings and provider coverage; verify event meaning and instrumentation changes before prioritizing SEO work.",
+          );
+        if (normalized.dimensions[0] === "hostName") {
+          const other = allRows.filter(
+            (row) =>
+              row.keys[0] !== config.productionHostname && row.values.some((v) => (parseNumericValue(v) ?? 0) > 0),
+          );
+          if (other.length)
+            add(
+              "other-hostnames",
+              "info",
+              `The hostname census contains activity on ${other.length} other observed hostname(s): ${other
+                .slice(0, maxRows)
+                .map((r) => r.keys[0])
+                .join(
+                  ", ",
+                )}. This does not invalidate correctly production-filtered reports or identify internal visitors on production.`,
+              [name],
+              "Keep production reports filtered to the intended hostname; separately evaluate internal-traffic handling.",
+            );
+        }
+        if (name === "ga.report.eventName") {
+          const keyIndex = normalized.metrics.indexOf("keyEvents");
+          const eventRows = allRows.filter((r) => (parseNumericValue(r.values[keyIndex]) ?? 0) > 0);
+          if (eventRows.length > maxRows)
+            add(
+              "event-findings-capped",
+              "info",
+              `Showing ${maxRows} of ${eventRows.length} observed event rows with positive key-event counts.`,
+              [name],
+              "Increase maxRows or inspect the original report for other event names.",
+            );
+          for (const row of eventRows.slice(0, maxRows)) {
+            const event = row.keys[0];
+            const excluded = config.context.excludedKeyEvents.includes(event);
+            add(
+              excluded ? "excluded-key-event" : "reported-key-event",
+              excluded ? "attention" : "info",
+              `${event}: ${row.values[keyIndex]} reported key events${excluded ? "; excluded from success metrics by site configuration" : "; business meaning is not validated by its name or count"}.`,
+              [name],
+              "Inspect the event definition and verify the real user action; do not infer its generation rule from the name.",
+            );
+          }
+          for (const configured of configuredKeyEvents.slice(0, maxRows))
+            if (!allRows.some((r) => r.keys[0] === configured.eventName))
+              add(
+                "configured-event-not-observed",
+                "info",
+                `GA-configured key event ${configured.eventName} has no observed event row in this period and scope. This does not establish zero activity or broken tracking.`,
+                ["ga.key-events", name],
+                "Check date, hostname and report coverage before investigating the event's instrumentation.",
+              );
+          for (const event of config.context.successEvents.slice(0, maxRows))
+            if (!allRows.some((r) => r.keys[0] === event))
+              add(
+                "success-event-not-observed",
+                "unknown",
+                `Configured success event ${event} has no observed row in this report; that is not proof of zero events or broken tracking.`,
+                [name, "context.config.context.successEvents"],
+                "Check report coverage, dates, filters and a real user flow.",
+              );
+        }
+      } catch (error) {
+        add(
+          "report-unusable",
+          "unknown",
+          `${name}: ${error instanceof Error && error.name !== "ZodError" ? error.message : "Request or response does not match the supported report shape."}`,
+          [name],
+          "Inspect the original report and recollect a compatible snapshot before drawing conclusions.",
+        );
+      }
+    }
+    for (const observation of observations.filter((o) => o.status !== "ok" || o.error))
+      add(
+        "provider-incomplete",
+        "unknown",
+        `${observation.name}: ${observation.status}${observation.error ? ` (${observation.error.code})` : ""}.`,
+        [observation.name],
+        "Inspect the retained provider error or pagination before relying on missing data.",
+      );
+    return {
+      assessmentVersion: 1,
+      site: config.site,
+      requestedDates: context.requestedDates,
+      collectedAt: snapshot.finishedAt,
+      basis: "saved-snapshot-not-reverified",
+      snapshotSha256: hash,
+      providerSelection: {
+        gsc: Boolean(config.gscSite),
+        ga: Boolean(config.gaProperty),
+        bing: Boolean(config.bingSite),
+      },
+      findings,
+      tables,
+      displayLimit: maxRows,
+      observations: observations.map((o) => ({
+        name: o.name,
+        provider: o.provider,
+        status: o.status,
+        warnings: o.warnings,
+        errorCode: o.error?.code ?? null,
+      })),
+      limitations: [
+        ...new Set([
+          ...snapshot.warnings,
+          "This assessment describes supplied snapshot evidence; it makes no new provider requests and does not authenticate imported claims. The hash identifies normalized snapshot JSON, not file bytes.",
+          "Configured success events are caller-designated, not independently validated. Aggregate reports cannot diagnose duplicate tags, prove a particular browser test arrived, or establish SEO causation.",
+          "Tables retain raw values for observed rows; capped lists are not exhaustive rankings. GSC property, page and query counts and GA sessions have different semantics and must not be reconciled as a funnel.",
+        ]),
+      ],
+    };
+  });
+  const assessment = result.pages[0]?.response as { findings: Finding[]; tables: AssessmentTable[] } | undefined;
+  if (
+    result.status !== "error" &&
+    (snapshot.status !== "ok" ||
+      snapshot.error ||
+      assessment?.findings.some((f) => f.level === "unknown") ||
+      assessment?.tables.some((t) => !t.complete))
+  )
+    result.status = "partial";
+  return result;
+}

package/src/api/change-record.ts

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { httpUrl } from "./http-url.js";
+
+const contextChange = z.object({ at: z.string().datetime(), description: z.string().min(1).max(2000) }).strict();
+export const changeRecordSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    id: z.string().min(1).max(200),
+    site: httpUrl,
+    affectedUrls: z.array(httpUrl).min(1).max(100),
+    description: z.string().min(1).max(4000),
+    hypothesis: z.string().min(1).max(4000),
+    deployedAt: z.string().datetime(),
+    expectedSignal: z.string().min(1).max(2000),
+    measurementChanges: z.array(contextChange).max(100),
+    overlappingChanges: z.array(contextChange).max(100),
+  })
+  .strict()
+  .superRefine((record, ctx) => {
+    for (const [index, url] of record.affectedUrls.entries()) {
+      if (new URL(url).origin !== new URL(record.site).origin)
+        ctx.addIssue({
+          code: "custom",
+          path: ["affectedUrls", index],
+          message: "Affected URL must share the site's origin",
+        });
+    }
+    if (Date.parse(record.deployedAt) > Date.now())
+      ctx.addIssue({ code: "custom", path: ["deployedAt"], message: "Deployment must not be in the future" });
+  });
+export type ChangeRecord = z.infer<typeof changeRecordSchema>;

package/src/api/cloudflare.ts

@@ -0,0 +1,201 @@
+import { z } from "zod";
+import { cloudflareGraphql, type CloudflareQuery } from "../providers/cloudflare.js";
+import { aggregate, capture, type Evidence } from "./evidence.js";
+
+const responseSchema = z
+  .object({
+    data: z
+      .object({ viewer: z.object({ zones: z.array(z.object({ zoneTag: z.string() }).passthrough()) }).nullable() })
+      .nullable()
+      .optional(),
+    errors: z.array(z.unknown()).nullable().optional(),
+  })
+  .passthrough();
+type Input = { zone: string; hostname: string; startTime: string; endTime: string; limit: number };
+// AIDEV-NOTE: Fixed selections exclude IPs, query strings and credentials. New fields change the privacy contract.
+export function cloudflareRequests(input: Input): Array<{ name: string; dataset: string; request: CloudflareQuery }> {
+  const zoneVar = { zone: input.zone };
+  const filters = {
+    datetime_geq: input.startTime,
+    datetime_lt: input.endTime,
+    clientRequestHTTPHost: input.hostname.toLowerCase(),
+  };
+  return [
+    {
+      name: "settings",
+      dataset: "settings",
+      request: {
+        query: `query Settings($zone: string) { viewer { zones(filter: {zoneTag: $zone}) { zoneTag settings { httpRequestsAdaptiveGroups { enabled maxDuration maxPageSize notOlderThan availableFields } firewallEventsAdaptive { enabled maxDuration maxPageSize notOlderThan availableFields } } } } }`,
+        variables: zoneVar,
+      },
+    },
+    {
+      name: "http",
+      dataset: "httpRequestsAdaptiveGroups",
+      request: {
+        query: `query Http($zone: string, $filter: ZoneHttpRequestsAdaptiveGroupsFilter_InputObject, $limit: uint64) { viewer { zones(filter: {zoneTag: $zone}) { zoneTag httpRequestsAdaptiveGroups(filter: $filter, limit: $limit, orderBy: [count_DESC]) { count avg { sampleInterval } dimensions { clientRequestHTTPHost clientRequestPath edgeResponseStatus originResponseStatus cacheStatus userAgent verifiedBotCategory } } } } }`,
+        variables: { ...zoneVar, filter: filters, limit: input.limit },
+      },
+    },
+    {
+      name: "security",
+      dataset: "firewallEventsAdaptive",
+      request: {
+        query: `query Security($zone: string, $filter: FirewallEventsAdaptiveFilter_InputObject, $limit: uint64) { viewer { zones(filter: {zoneTag: $zone}) { zoneTag firewallEventsAdaptive(filter: $filter, limit: $limit, orderBy: [datetime_DESC]) { datetime action source clientRequestHTTPHost clientRequestPath edgeResponseStatus userAgent verifiedBotCategory sampleInterval } } } }`,
+        variables: { ...zoneVar, filter: filters, limit: input.limit },
+      },
+    },
+  ];
+}
+
+export async function cloudflareAudit(input: Input, query = cloudflareGraphql): Promise<Evidence> {
+  const observations: Evidence[] = [];
+  for (const planned of cloudflareRequests(input)) {
+    const observation = await capture("cloudflare", planned.name, input.zone, planned.request, () =>
+      query(planned.request),
+    );
+    observation.name = `cloudflare.${planned.name}`;
+    const raw = observation.pages[0]?.response;
+    if (raw !== undefined) {
+      const parsed = responseSchema.safeParse(raw);
+      const zones = parsed.success ? parsed.data.data?.viewer?.zones : undefined;
+      const zone = zones?.length === 1 && zones[0].zoneTag === input.zone ? zones[0] : undefined;
+      const usable = Boolean(zone && Object.hasOwn(zone, planned.dataset) && zone[planned.dataset] !== null);
+      if (!parsed.success || !usable || parsed.data.errors?.length) {
+        observation.status = usable ? "partial" : "error";
+        observation.error = {
+          code: parsed.success ? "graphql_error" : "invalid_response",
+          message: "Cloudflare returned unavailable or incomplete dataset evidence; inspect retained GraphQL response",
+          httpStatus: 200,
+        };
+      }
+    }
+    observation.credential = { source: "CLOUDFLARE_API_TOKEN", type: "api_token", clientEmail: null };
+    observation.warnings.push(
+      "Adaptive datasets can contain estimated/sampled values. Retain sampleInterval; do not multiply already estimated counts again.",
+      "Dataset availability, retained history and maximum query duration depend on zone settings. Missing or denied data is unknown, not zero.",
+    );
+    if (planned.name !== "settings")
+      observation.warnings.push(
+        `At most ${input.limit} ${planned.name === "http" ? "groups ordered by count descending" : "security events ordered newest first"} are retained; this is not exhaustive traffic or crawler coverage.`,
+      );
+    observations.push(observation);
+  }
+  const diagnostics: Array<{
+    dataset: string;
+    observedRows: number | null;
+    possiblyTruncated: boolean;
+    effectiveRowLimit: number;
+    unusableRows: number;
+    collectedAt: string;
+    errorPaths: unknown[];
+  }> = [];
+  const unknowns: string[] = [];
+  const settingsSchema = z.object({
+    enabled: z.boolean(),
+    maxDuration: z.number().nonnegative(),
+    maxPageSize: z.number().int().positive().optional(),
+    notOlderThan: z.number().nonnegative(),
+    availableFields: z.array(z.string()),
+  });
+  const settingsObservation = observations[0];
+  const settingsRaw = responseSchema.safeParse(settingsObservation.pages[0]?.response);
+  const settingsZone = settingsRaw.success
+    ? settingsRaw.data.data?.viewer?.zones?.find((z) => z.zoneTag === input.zone)
+    : undefined;
+  const settings = settingsZone?.settings as Record<string, unknown> | undefined;
+  for (let index = 1; index < observations.length; index++) {
+    const observation = observations[index];
+    const dataset = index === 1 ? "httpRequestsAdaptiveGroups" : "firewallEventsAdaptive";
+    const parsed = responseSchema.safeParse(observation.pages[0]?.response);
+    const zone = parsed.success ? parsed.data.data?.viewer?.zones?.find((z) => z.zoneTag === input.zone) : undefined;
+    const rows = Array.isArray(zone?.[dataset]) ? (zone[dataset] as unknown[]) : null;
+    const unusableRows =
+      rows?.filter((row) => {
+        if (!row || typeof row !== "object") return true;
+        const value = row as Record<string, unknown>;
+        const dimensions = value.dimensions as Record<string, unknown> | undefined;
+        const hostname = index === 1 ? dimensions?.clientRequestHTTPHost : value.clientRequestHTTPHost;
+        return typeof hostname !== "string" || hostname.toLowerCase() !== input.hostname.toLowerCase();
+      }).length ?? 0;
+    const declared = settingsObservation.status === "ok" ? settingsSchema.safeParse(settings?.[dataset]) : null;
+    if (!declared?.success)
+      unknowns.push(`${dataset}: settings unavailable or incomplete; retention/availability are unknown.`);
+    else {
+      if (!declared.data.enabled) unknowns.push(`${dataset}: dataset is currently disabled for this zone.`);
+      if (Date.parse(input.startTime) < Date.parse(settingsObservation.finishedAt) - declared.data.notOlderThan * 1000)
+        unknowns.push(`${dataset}: requested start is outside the currently declared retention window.`);
+      if (Date.parse(input.endTime) - Date.parse(input.startTime) > declared.data.maxDuration * 1000)
+        unknowns.push(`${dataset}: interval exceeds currently declared maximum duration.`);
+    }
+    const providerRowLimit = declared?.success ? declared.data.maxPageSize : undefined;
+    const effectiveRowLimit = Math.min(input.limit, providerRowLimit ?? input.limit);
+    if (providerRowLimit === undefined)
+      unknowns.push(`${dataset}: provider maximum page size unavailable; provider truncation is unknown.`);
+    if (rows && rows.length >= effectiveRowLimit)
+      unknowns.push(`${dataset}: retained row limit reached; additional rows may exist.`);
+    if (rows?.length === 0)
+      unknowns.push(`${dataset}: empty retained set, not proof of zero traffic or security actions.`);
+    if (unusableRows) {
+      unknowns.push(
+        `${dataset}: ${unusableRows} rows do not match the requested hostname/shape; raw data retained without association.`,
+      );
+      if (observation.status === "ok") observation.status = "partial";
+    }
+    if (!rows && observation.status === "ok") {
+      observation.status = "error";
+      observation.error = {
+        code: "invalid_response",
+        message: "Cloudflare dataset is not a row array",
+        httpStatus: 200,
+      };
+    }
+    const issues = unknowns.filter((u) => u.startsWith(`${dataset}:`));
+    observation.warnings.push(...issues);
+    diagnostics.push({
+      dataset,
+      observedRows: rows?.length ?? null,
+      possiblyTruncated: Boolean(rows && rows.length >= effectiveRowLimit),
+      effectiveRowLimit,
+      unusableRows,
+      collectedAt: observation.finishedAt,
+      errorPaths: parsed.success
+        ? (parsed.data.errors ?? [])
+            .slice(0, 3)
+            .map((e) => (e && typeof e === "object" ? ("path" in e ? e.path : null) : null))
+        : [],
+    });
+  }
+  const result = aggregate("cloudflare.audit", input.zone, input, observations);
+  Object.assign(result.pages[0].response as object, {
+    scope: {
+      zone: input.zone,
+      hostname: input.hostname,
+      startInclusive: input.startTime,
+      endExclusive: input.endTime,
+      timezone: "UTC",
+      limit: input.limit,
+      ordering: { http: "count_DESC", security: "datetime_DESC" },
+      querySignature: Bun.CryptoHasher.hash(
+        "sha256",
+        JSON.stringify(cloudflareRequests(input).map((p) => p.request.query)),
+        "hex",
+      ),
+      settingsCollectedAt: settingsObservation.finishedAt,
+      settingsMeaning: "Current zone settings, not proof of settings during the historical reporting window",
+    },
+    diagnostics,
+    unknowns,
+    limitations: [
+      "No path joins to GSC/GA: Cloudflare paths omit query strings. Cloudflare is not supported by Pagesight report comparisons or conversion funnels.",
+      "HTTP traffic is not verified search-engine crawling. User-Agent can be spoofed; verifiedBotCategory is Cloudflare's classification, not proof of Google indexing or a particular crawler identity.",
+      "Security events describe observed actions, not all requests or all challenges. Do not reconcile sampled event counts with HTTP groups as a funnel.",
+      "Edge status and origin status differ; cached/edge-handled requests may have no origin response. Status zero does not mean successful origin access.",
+      "No client IP, request query string, cookies or authentication headers are requested. Paths and user agents may still be sensitive: keep reports private.",
+      "Only read-only GraphQL analytics queries execute; no Cloudflare security, cache, DNS or crawler settings are modified.",
+    ],
+  });
+  result.credential = { source: "CLOUDFLARE_API_TOKEN", type: "api_token", clientEmail: null };
+  if (result.status === "ok" && unknowns.length) result.status = "partial";
+  return result;
+}